2

I have seen the Moonsols Memory Toolkit for Windows (Community Edition). It however does not support x64 memory dumping. Only its professional version can do that. Are there any free alternatives out there that do the same ? To narrow down what I am looking for I would be interested in features like -:

  • Convert a memory dump from a x64 Architecture.

  • Convert or decompress Windows 7 hibernation files.

  • Convert a Windows 7 memory dump.

I have seen a lot of free tools for x86, but for x64 its a whole different ball game.

Improve this question

3 Answers 3

Reset to default
2

Volatility supports x64 Windows 7 hibernation files as well as x64 images.

Improve this answer
2
1

Have you tried Moonsols Dumpit? It is a free utility that can grab the physical memory.

http://www.moonsols.com/2011/07/18/moonsols-dumpit-goes-mainstream/

Rekall might be able to help with the acquisition piece as well.

http://www.rekall-forensic.com/index.html

Improve this answer
9
  • Do they support x64 ?
    – Sreyan
    Nov 30, 2014 at 9:53
  • Also do any of the allow the editing of x64 Windows hibernation files ?
    – Sreyan
    Nov 30, 2014 at 10:08
  • You can download winpmem from the Rekall project for dumping Win x64 memory directly form here: github.com/google/rekall/releases/download/v1.0rc11/…
    – Jonas Lejon
    Nov 30, 2014 at 14:46
  • @jonasl Just bear with me then. I use recall to dump the Winx64 memory and I analyze that using Volatility. Am I doing the right thing then ?
    – Sreyan
    Nov 30, 2014 at 16:39
  • @Sreyan no Rekall is a fork (rewrite) of Volatility from Google so basically you're going to use it like Volatility
    – Maijin
    Dec 3, 2014 at 11:05
0

Mandiant Redline might be helpful as well.

https://www.mandiant.com/resources/download/redline

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.